updated session secret as ENV variable