Move the SESSION_SECRET to env vars

This should stop the `SESSION_SECRET` being forwarded to clients.

However, this *does not* fix the fact that `SESSION_SECRET` is actually secret at deployment. For now, in production it will use the session secret available in `.awsbox.json`.