Use new clientsession for a more secure secret

Fixes #85
Makes sense.