Changed dataAccess to use Heroku connection string env variable; moved cookie and session secrets to .env