Fix location of messages.json. It is intentionally not in public/data.
Also, update express-session options.