externalize session secret