app.js: don't use the same session secret everywhere

Aaaaaaaaaargh. To use the technical term.
Remove unused code (Mk. 2)