public function __invoke(Request $request, Response $response, callable $out = null)
{
$session = $this->startSession();
$request = $request->withAttribute('session', $session);
$response = $out ? $out($request, $response) : $response;
$response = $this->withCsrfTokenHeader($response, $session);
return $this->withSessionCookie($response, $session);
}