keep the session simple, store mongoid ids as strings
Removed devise secret key from source
Fixed email default from