Switch to SignedCookieSessionFactory with a secret configured a non-checked in file.
Merge pull request #123 from ENCODE-DCC/auth-secret-from-file

Session secret in file