refactor(session): remove Session.config

One more blow to Session
A broker audit reveals they do not need `oAuthUrl`, removing.