diff --git a/Dockerfile.tmpl b/Dockerfile.tmpl
index 100cd3bf..a9465cae 100644
--- a/Dockerfile.tmpl
+++ b/Dockerfile.tmpl
@@ -13,5 +13,3 @@ COPY --from=server /src/bin/neko /usr/bin/neko
 COPY --from=client /src/dist/ /var/www
 COPY --from=xorg-deps /usr/local/lib/xorg/modules/drivers/dummy_drv.so /usr/lib/xorg/modules/drivers/dummy_drv.so
 COPY --from=xorg-deps /usr/local/lib/xorg/modules/input/neko_drv.so /usr/lib/xorg/modules/input/neko_drv.so
-
-COPY config.yml /etc/neko/neko.yaml
diff --git a/config.yml b/config.yml
deleted file mode 100644
index 8cb20f2c..00000000
--- a/config.yml
+++ /dev/null
@@ -1,17 +0,0 @@
-desktop:
-  screen: "1920x1080@60"
-
-member:
-  # needed for legacy API ad there is no user management
-  provider: "multiuser"
-  multiuser:
-   admin_password: "admin"
-   user_password: "neko"
-
-session:
-  merciful_reconnect: true
-  # default setting for legacy API
-  implicit_hosting: false
-  cookie:
-    # needed for legacy API
-    enabled: false
diff --git a/docker-compose.yaml b/docker-compose.yaml
index 5d7860df..f0428c13 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -1,16 +1,36 @@
 services:
   neko:
+    # Runs Firefox in Neko. Firefox is the default, most tested image, but Neko
+    # supports many other browsers and applications - see the full list here:
+    # https://neko.m1k1o.net/docs/v3/installation/docker-images#apps
     image: "ghcr.io/m1k1o/neko/firefox:latest"
     restart: "unless-stopped"
     shm_size: "2gb"
     ports:
       - "8080:8080"
       - "52000-52100:52000-52100/udp"
+    # volumes:
+      # Persist Firefox settings, bookmarks, extensions and history across
+      # container restarts by mounting the profile directory.
+      # See: https://neko.m1k1o.net/docs/v3/customization/browsers#persistent-profile
+      # - "./profile:/home/neko/.mozilla/firefox/profile.default"
+
+      # Or mount your own pre-configured Firefox profile instead of an empty one.
+      # See: https://neko.m1k1o.net/docs/v3/customization/browsers#persistent-profile
+      # - "./my-custom-profile:/home/neko/.mozilla/firefox/profile.default"
     environment:
+      # You can configure either EPR or MUX ports for WebRTC.
+      # See: https://neko.m1k1o.net/docs/v3/configuration/webrtc#network
+      NEKO_WEBRTC_EPR: 52000-52100
+      # Specify the screen resolution and refresh rate for the virtual desktop. The
+      # default is 1920x1080@30, but you can change it to any other resolution.
+      # See: https://neko.m1k1o.net/docs/v3/configuration/desktop#screen
       NEKO_DESKTOP_SCREEN: 1920x1080@30
+      # You can configure a password for the default user and admin accounts. The
+      # default user account is "neko" and the default admin account is "admin".
+      # See: https://neko.m1k1o.net/docs/v3/configuration/authentication#member.multiuser
       NEKO_MEMBER_MULTIUSER_USER_PASSWORD: neko
       NEKO_MEMBER_MULTIUSER_ADMIN_PASSWORD: admin
-      NEKO_WEBRTC_EPR: 52000-52100
-      NEKO_WEBRTC_ICELITE: 1
-      # See: https://neko.m1k1o.net/docs/v3/configuration/webrtc#ip
-      # NEKO_NAT1TO1: <IP_ADDRESS>
+      # Specifying reachable IP by clients is required when running Neko.
+      # See: https://neko.m1k1o.net/docs/v3/configuration/webrtc#nat1to1
+      NEKO_WEBRTC_NAT1TO1: <your-IP>
diff --git a/server/dev/start b/server/dev/start
index c5aa6829..12ef32a0 100755
--- a/server/dev/start
+++ b/server/dev/start
@@ -61,7 +61,8 @@ docker run --rm -it \
     -e "NEKO_WEBRTC_TCPMUX=${NEKO_MUX}" \
     -e "NEKO_WEBRTC_NAT1TO1=${NEKO_NAT1TO1}" \
     -e "NEKO_SESSION_FILE=/home/neko/sessions.txt" \
-    -v "${PWD}/runtime/$CONFIG:/etc/neko/neko.yml" \
+    -e "NEKO_SERVER_CORS=*" \
+    -v "${PWD}/runtime/$CONFIG:/etc/neko/neko.yaml" \
     -e "NEKO_DEBUG=1" \
     --shm-size=2G \
     --security-opt seccomp=unconfined \
diff --git a/server/internal/config/session.go b/server/internal/config/session.go
index b0851d24..b5e90520 100644
--- a/server/internal/config/session.go
+++ b/server/internal/config/session.go
@@ -60,7 +60,7 @@ func (Session) Init(cmd *cobra.Command) error {
 		return err
 	}
 
-	cmd.PersistentFlags().Bool("session.implicit_hosting", true, "allow implicit control switching")
+	cmd.PersistentFlags().Bool("session.implicit_hosting", false, "allow implicit control switching")
 	if err := viper.BindPFlag("session.implicit_hosting", cmd.PersistentFlags().Lookup("session.implicit_hosting")); err != nil {
 		return err
 	}
@@ -86,7 +86,7 @@ func (Session) Init(cmd *cobra.Command) error {
 	}
 
 	// cookie
-	cmd.PersistentFlags().Bool("session.cookie.enabled", true, "whether cookies authentication should be enabled")
+	cmd.PersistentFlags().Bool("session.cookie.enabled", false, "whether cookies authentication should be enabled")
 	if err := viper.BindPFlag("session.cookie.enabled", cmd.PersistentFlags().Lookup("session.cookie.enabled")); err != nil {
 		return err
 	}
diff --git a/webpage/docs/configuration/help.json b/webpage/docs/configuration/help.json
index 8320f7e9..53d7bf6b 100644
--- a/webpage/docs/configuration/help.json
+++ b/webpage/docs/configuration/help.json
@@ -511,7 +511,7 @@
       "enabled"
     ],
     "type": "boolean",
-    "defaultValue": "true",
+    "defaultValue": "false",
     "description": "whether cookies authentication should be enabled"
   },
   {
@@ -577,7 +577,7 @@
       "heartbeat_interval"
     ],
     "type": "int",
-    "defaultValue": "120",
+    "defaultValue": "10",
     "description": "interval in seconds for sending heartbeat messages"
   },
   {
@@ -586,7 +586,7 @@
       "implicit_hosting"
     ],
     "type": "boolean",
-    "defaultValue": "true",
+    "defaultValue": "false",
     "description": "allow implicit control switching"
   },
   {
diff --git a/webpage/docs/configuration/help.txt b/webpage/docs/configuration/help.txt
index 89ef9120..31e76192 100644
--- a/webpage/docs/configuration/help.txt
+++ b/webpage/docs/configuration/help.txt
@@ -52,15 +52,15 @@
       --session.api_token string                      API token for interacting with external services
       --session.control_protection                    users can gain control only if at least one admin is in the room
       --session.cookie.domain string                  domain of the cookie
-      --session.cookie.enabled                        whether cookies authentication should be enabled (default true)
+      --session.cookie.enabled                        whether cookies authentication should be enabled
       --session.cookie.expiration duration            expiration of the cookie (default 24h0m0s)
       --session.cookie.http_only                      use http only cookies (default true)
       --session.cookie.name string                    name of the cookie that holds token (default "NEKO_SESSION")
       --session.cookie.path string                    path of the cookie
       --session.cookie.secure                         use secure cookies (default true)
       --session.file string                           if sessions should be stored in a file, otherwise they will be stored only in memory
-      --session.heartbeat_interval int                interval in seconds for sending heartbeat messages (default 120)
-      --session.implicit_hosting                      allow implicit control switching (default true)
+      --session.heartbeat_interval int                interval in seconds for sending heartbeat messages (default 10)
+      --session.implicit_hosting                      allow implicit control switching
       --session.inactive_cursors                      show inactive cursors on the screen
       --session.locked_controls                       whether controls should be locked for users initially
       --session.locked_logins                         whether logins should be locked for users initially