made parser and session secret the same, in anticipation of express clearing up what is necessary and wwhat isn't