Change regexp anchor to match start of line only

security issue reported by codeclimate
remove dangerous send

spotted by codeclimate
Remove session secret from version control

Because duh. Allow setting by env var, or generate a random one if missing (only really for development/test)
Merge pull request #94 from theodi/bugfix-security-issues

Fix security issues spotted by codeclimate