added env session_secret