do not remove authfile, session max in a var