work on session cookie config option.
refactor session service provider to allow configurable keys.