move session store secret out of repo. update readme