Move session internal state to own class

[alexamici]

The _ candidates_* attributes of the config object are the internal state of the plugin and are better represented as a class.