server now pulls session secret from azure config