session secret in provisioning
change soup-nuts to app