Exclude /status, /metrics from session middleware

Because of seemingly undocumented changes in passport 0.5.0,
passport now crashes on requests to paths without session data.

This removes the session middleware from /status and /metrics, which are
 excluded from sessions since 90c5ab0833.

 Fixes https://github.com/hedgedoc/container/issues/270

Signed-off-by: David Mehren <git@herrmehren.de>

app.js

@@ -175,7 +175,7 @@ app.use(flash())
 
 // passport
 app.use(passport.initialize())
-app.use(passport.session())
+app.use(useUnless(['/status', '/metrics'], passport.session()))
 
 // check uri is valid before going further
 app.use(require('./lib/web/middleware/checkURIValid'))