default session secret if env variable unavailable