Remove session secret from version control

Replace with an env var or random setting. Spotted by codeclimate.
Merge pull request #18 from theodi/bugfix-security-issues

Fix codeclimate security issues