Set session_secret for non production environments

This prevents sessions from expiring on app restarts as
Rack will use a random secret if it's not user defined