app.secretkey is optional now