doc: SESSION_SECRET should be private

[binajmen]

I believe the SESSION_SECRET should not come from the public environment variables as stated in the example available at https://start.solidjs.com/advanced/session:

import { createCookieSessionStorage } from "solid-start";
 
const storage = createCookieSessionStorage({
  cookie: {
    name: "session",
    secure: import.meta.env.PROD,
    secrets: [import.meta.env.VITE_SESSION_SECRET], // <-- leak?
    sameSite: "lax",
    path: "/",
    maxAge: 60 * 60 * 24 * 30, // 30 days
    httpOnly: true
  }
});

This will leak the session secret in the client bundle according to Vite security notes.

I discussed this issue here OrJDev/create-jd-app#24 with an alternative.

[binajmen]

#578