[#355] Allow overriding of cookie session secret via environment variable.