wrapper session cookie middleware