I believe the session secret should be moved to a config file since session data should be secure. Pick a new string when you do it.