secret: Use an environment variable for session secret.