Cookie-based sessions about bocadillo

[zgoda]

This will require that any kind of persistent configuration exist - to use cookie based sessions one needs to have secret key that is persisted between application restarts (or else all sessions will be invalidated). This key may be read from environment variable but there are other options that are worth configuring for sessions like lifetime.

[florimondmanca]

I think reading the secret key from an environment variable should be enough, wouldn't it? In Django, that's always where I get the secret key from.

Makes me think that:

• We could make the session middleware read it from the environment by default, so that we can simply set enable_sessions=True.
• May be worth considering adding a dev dependency on python-dotenv and running load_dotenv() in debug mode, so that we can easily setup a SECRET_KEY in a .env file and have it made available to the app.