Session secret can be set on initialization, if you cannot set the environment variable.