Set session cookie secret (for real this time)