Move session secret to env variable