Use a consistent session secret (from the environment).