Change session secret key

and remove hardcoded dev version to quieten down codeclimate
resolve security warning by not using param in redirect
Merge pull request #79 from theodi/security

Security fixes