pull session secret from ENV