HTTP session secret is now a hash from UUID and config-supplied secret.