little more cleanup
put version check/config check after sessions/rate limiter so it works correctly & only uses 1 db hit