Session secret is always the same.  This has to change, obviously.