move session exceptions list to conf.example.js