make the session_secret and pwsalt be read from configuration