Remove the static SECRET_KEY and generate one if it does not yet exist. Thanks to Erik Romijn for pointing that out. http://blog.solidlinks.nl/post/48950359200/proof-of-concept-arbitrary-remote-code-execution