Be more assertive about changing SESSION_SECRET
Use env file