add own fpm pool so that the session isn't shared
run pool as www-data to tighten security