fix: applyConfig must make sure no session has been started

[samayo]

the main concern is the potential for the security settings to be bypassed if a session is already started when the class is instantiated. This could lead to using less secure default settings instead of the more robust ones defined in the class.

in other words, if session has been already started outside the file the the security parameters will not be applied.