added SESSION_SECRET