makes session secret configurable via ENV