session secret for heroku
gitignore updated for github session secret