Cleaned up app.js, removed session secret from default config and generate one at runtime per server instance. Should work as long as we do not start load balancing