move session secret to env var