fix config property name, add a session secret
no idea why these weren't throwing errors in development