# Session factory
    session_secret = settings['session.secret']
    sess_factory = SignedCookieSessionFactory(
        session_secret,
        reissue_time=1,
        max_age=28800
    )
    config.set_session_factory(sess_factory)

    # Security Policies
    authn_policy = AuthTktAuthenticationPolicy(
        settings['auth.secret'],
        callback=groupfinder,
        hashalg='sha512',
        reissue_time=1,
        max_age=28800
    )
    authz_policy = ACLAuthorizationPolicy()
    config.set_authentication_policy(authn_policy)
    config.set_authorization_policy(authz_policy)