Function web 

pub fn web() -> MiddlewareStack

Security headers plus a session — what a browser-facing page wants.

The session stage is resolved from the container when the router compiles, because the store is chosen in bootstrap.rs and does not exist while routes are being declared.