skip test_session_new as it requires an one-time-use authenticated request token

can be overridden by --no-skip
support getting api key and debug url from env vars
add encrypted TMDB_API_KEY