Make it obvious where session secrets go