allow specifying CLIENT_SESSION_KEY via env var
sh on Heroku is dash; just use bash