make encrypted sessions optional (enabled by default). move encryption
constants to index.php