fixes #41
added a test for #41
Merge pull request #53 from ekini/master

If the secret key for an app changes, the user session can become corrupted.