Use new clientsession for a more secure secret

Fixes #85
Use correct session key environment variable