diff --git a/src/tbd/auth/middleware.clj b/src/tbd/auth/middleware.clj
index 6efd7c8..1131b47 100644
--- a/src/tbd/auth/middleware.clj
+++ b/src/tbd/auth/middleware.clj
@@ -10,15 +10,13 @@
   "Cookie-backed sessions (encrypted and signed, so nothing is stored server-side). Lax, not
   Strict: the OAuth callback is a cross-site redirect from Gitea and must still carry the
   cookie that holds the login `state`."
-  [config]
-  (let [store (cookie-store {:key (auth/session-key (:session-secret config))})]
-    (fn [handler]
-      (wrap-session handler {:store store
-                             :cookie-name "tbd-session"
-                             :cookie-attrs {:http-only true
-                                            :same-site :lax
-                                            :secure (:secure-cookies? config)
-                                            :max-age (quot session-ttl-ms 1000)}}))))
+  [handler config]
+  (wrap-session handler {:store (cookie-store {:key (auth/session-key (:session-secret config))})
+                         :cookie-name "tbd-session"
+                         :cookie-attrs {:http-only true
+                                        :same-site :lax
+                                        :secure (:secure-cookies? config)
+                                        :max-age (quot session-ttl-ms 1000)}}))
 
 (defn current-user
   "The logged-in user from the session, or nil when there is none or it has expired. The
diff --git a/src/tbd/core.clj b/src/tbd/core.clj
index c009d21..bf06fa6 100644
--- a/src/tbd/core.clj
+++ b/src/tbd/core.clj
@@ -115,7 +115,7 @@
           (ring/create-default-handler)))
       wrap-head
       http/wrap-browser-viewable-edn
-      ((auth-mw/session-middleware auth))))
+      (auth-mw/session-middleware auth)))
 
 (def config
   {:auth (auth/env-config)