Move session secret to environment variable.