less stupid default session secret