move session secret to conf