... minute check for anyone running a long-lived app server: PHP under RoadRunner or Swoole, Node, anything where one process serves request after request instead of starting fresh each time. List the values your templates read that middleware sets per request: the signed-in flag, the avatar, the CSRF token, the analytics user id. Then ask what each of them holds on a request where that middleware did not run. In a process-per-request world the answer is nothing ...