Session secret is now configurable (should've always been, WTF)