HTTP secret for session tokens is now part of CONFIG