added session secret as ENV variable