externalized session secrets, specifying less 1.3.3 so less-middleware has a usable version