read session secret from env in production