Use a secret token for sessions

Mostly a hoop-jumping exercise - we don't /want/ sessions, but we have them
anyway because gds-sso forces us to. Because we have sessions, if there's no
secret, the sessions can be forged, so we might be vulnerable.