generate session secret when package is installed

It's a little bit ugly, but this way the user don't have to generate the unique session secret himself. Tested on my installation.