listen session in config (secure and non-secure)