use hmac-signed cookie
remove locale from example data payload
make default gunicorn max_requests 0 because it does not help development mode
encrypt cookie-based session store