Use path.join() instead of concatenating and changed session secret.