moved session secret to global config