security updates; use sessions, local vs. deployed secret key