wip: Web API: use environment variables to set session_secret