Impossible to properly set SESSION_SECRET using enviroment variables

As can be seen in lib/config.js SESSION_SECRET is assigned the value of process.env.PORT or otherwise a default. I would assume this is a mistake, and it is supposed to read process.env.SESSION_SECRET