use uuid as main session secret