Removing app key and secret values from the code, in lieu of adding them to the environment. Adding a session secret to the environment. Added some comments.