add commenting
remove session defaults as they were breaking flash variables (and probably a lot more
remove unused secret variable