Fixes #1 - uses standard quickstart json config, removes unused session secret
merges Alexanders' updates with mine.