made parser and session secret the same, in anticipation of simplifying this when it's clear what express wants