had to set the session secret to get it to work