One line explanation of `SESSION_SECRET` would be helpful, to dissuade confused users from trying to use their S3 secrets (or something) here.