Clarify that the session secret token is set on rollout