`request.session['secondary_password']`. `get()` implies `None` return when unset, and this not something helpful here. Exception is better.