session secret is now configurable