add express3 to packages / fix config appSecret / add express3 sessionSecret