Move session secret in to config Secret file

It makes more sense that the session secret is in the secrets file then in the app.js file