remove session secret from app.js