A session secret is a key used for encrypting cookies. Application developers often set it to a weak key during development, and don't fix it during production.