remove session secret from source code