Explode early if session secret isn't set in production

resolves #21