Changed app secret token to environment variable. Added notice to actions requiring signin.
Changed root to Sessions#new