Fix : use secret when encoding session