add ConfigureMackineKeyForSessionTokens helper
do better checking on protect flag in config; loadMetata from config