changed session salt generation to out of app