note on body safety
cleanup blog app; use proper types
set attributes on root if directory exists, but doesnt have them set yet
no simple-session

Actual simple-session has LIO support, but exposing the KEY is
unsafe and depends on app, so we're not providing an instance by default.