Call this `sessionSecret` and use `dummy secret value` for consistency.

In fact, now that I think of it, since this is making client-side requests to events-service it should definitely be the same secret as what events/events service uses