more administration, moving towards apps in db instead of filesystem
explicitly set session secret for heroku
one-line the session secret stuff