XSS protection

Removes session key from version control in favor of the environmental variable
If the env variable doesn't exist (e.g. your development machine), use the key that was previously in version control.

closes #172