add session secret to make sure it can run