Use new clientsession for a more secure secret

Fixes #85
I'm switching the variable name for two reasons:

- Using a new name means both versions of the code work and I don't have to synchronize the `config:set` with the deploy
- `SESSION` is the default variable output from `clientsession-generate`, so the following should work:

```
% heroku config:set $(clientsession-generate)
```