configuring express session to use a secret defined in the config file,
not a hard coded one