Add SESSION_SECRET instructions to readme.md