Fix CSP; eliminate old prefixed versions
Switch to secret to avoid collisions
Be consistent with hmac secret on sessions
use secret