Session Secret

Added a env var that represents the session secret that is pulled into
the config.js file. This var is also validated to ensure it doesn't
match the default session secret.

This secret is now properly used to hash the user session and the cookie
sent to the user.