Fix persona not working against non-local

The problem was caused by having the host hardcoded as localhost /facepalm. Also
pulled the session secret out to a config value.