Session secret shouldn't be hard coded

As it was, any malicious user could hijack user sessions by imposing
himself as a different user. With this change, the session secret should
be set in an environment variable the same way as Twitter and Facebook
secrets, thus improving security.
Shell files do not allow spaces when assigning env