rename secret with sessionSecret to avoid scope confusion