The middleware exposes APIs for sessions as well (to refresh the session), and also a bunch of APIs for reset password and email verification. So if you remove that, all these APIs will have to be provided by you