added protect_session_state to security config, off by default