Use new clientsession for a more secure secret

Fixes #85
Removing this comment because the haddocks for `getKeyEnv` explain it better. Also, I hope to upstream this and remove the file entirely eventually.