after hook using createAuthMiddleware. However, when we fetch the session on the client, it still uses the original session type.customSession plugin, which overrides the /get-session route — but is that really the recommended approach for all plugins? It feels a bit hacky for something that should be more common.