staging gets its own secret key base (for session cookies)