Is middleware compatible with iron session? You could also juste encrypt it in JWT and decrypt it in middleware.