Server: move the SESSION_SECRET to env vars

This does not fix the fact that the session secret is actually secret at
deployment. For now, in production it will use the session secret available in
.awsbox.json.
Address pull request comments
Merge pull request #294 from tOkeshu/fix-session-secret

Move the SESSION_SECRET to env vars