Validate using express middleware

[mhoeger]

There's currently an example of "use"ing "cookie-parser" from express. This works, but we need to deeply explore if there will be cases where express middleware doesn't "just work", and how we can warn or prevent those scenarios (or if they're blockers on shipping "use")

[mhoeger]

Try passport and body-parser