Stop defaults in env.js overriding config.json values

The settings session:secret, app:port and theme:name set in the config.json are never used because the defaults in env.js override the values. This fix allows for these values to be set with ENV variables or in config.json. (e.g. setting the port). ENV values still override config.json values for settings. Defaults are required in config.json.