The secret is important: it would allow anyone to create a session with arbitrary content, in effect logging in as any user. This should be configurable by user, and should default to generate a secure random string on startup (http://www.ruby-doc.org/stdlib-1.9.3/libdoc/securerandom/rdoc/SecureRandom.html).