Ah, right, I knew that (or at least I thought I did)! :wink:

I think it's fair to assume that `openssl` in available. Ubuntu/Debian (latest stable) both ship with `openssl` installed, and for CentOS/Fedora we install `openssl-devel` which appears to depend on `openssl` (please correct me if I'm wrong).

I'd also prefer if the secret token remained the same between sessions on the host, unless changed intentionally. I'm fairly certain that changing the session secret breaks all active sessions, which I don't think is desirable in a production system.

@swanson do you have any input on this?