Support session_secret and update the example config
Use the correct route for match states