move session secret to ENV variables
change db design