mention dependency on pkg-config when compiling from source
set expiry on state cookies; don't clear session cookie after error