secret token setup change

dynamically generate session secret token ... with matching update to .gitignore