Allow overriding session cookie key with environment variable

Needed for sessions to work when hosting 2 gitorious instances, one at
example.org, second at second.example.org.