use an env var for session secret