form fieldset, session hashing, revert default private app ... (merge)