Shouldn't we just throw if no `SESSION_SECRET` at all is set? What's the default behavior when `SESSION_SECRET` is undefined here?