session id via config
session secret via config