webapp2 session secret should not be from random()