refactor session secret to config
initial client upload implementation