Simplify Session configuration

Always configure the default and custom sessions in the session
bootstrap file, instead of in an ad-hoc manner in the action file. Allow
for a custom secret to be set in the connections file on a per-app
basis. This is a BREAKING CHANGE. The `connections.php` file must be
updated to define the LITHIUM_APP_SECRET correctly.