Secure session

@joshmh as to that 'base64' for session secret, it doesn't really matter, node just accepts bytes.