Only .js files are trusted as loadable config files
Fix express-session config + version bump