set secret token from environment variable in production
Merge pull request #494 from theodi/env-session-secret

set secret token from environment variable in production