The session secret, or an ordered list of secrets for rotation: index 0 signs/encrypts new cookies while every entry can still open existing ones, so rotating a secret does not log everybody out.

When omitted, the secret is resolved from CAPABILITIES.SECRETS and then from the environment. Each secret must be at least 32 characters.