remove excess config settings and make session secret configurable