move session secret key to config file