use session secret from env variable