use SHA-256 for session secrets