resolved issue #3. no longer hackily generating a default session secret key on server start. require to be set in config.py instead.