I was thinking that the session stuff should not be hardcoded.
The secret being hardcoded is terribly bad already,
but also other cookie settings (such as maxAge) cannot be set
with the current usage of ``boot``.

For this reason, I believe apps need to set it by themselves or
we should expose an API, such as ``setSessionConfig({ ... })``