* Add unit test for `authenticate` middleware
* Add more cases
* Add tests for verifyOID and internalServerError
* Add tests for verifyHeader
* Add tests for authroize
Not all routes need session, register session and CSRF middleware as global is a waste of resource, and creating a lot one-time off yet never used session records.