application secret and session name from config