fixes localdata/localdata-api#95: remove SESSION_SECRET
it isn't used anywhere in the codebase according to grep