Session Secret docs

[Schwehn42]

Recently, we had an issue regarding the OAuth login, where a secret was missing: #4685

The problem was a side-effect caused from importing gorillaSessions, which lead to the cookie store being overridden – therefore requiring SESSION_SECRET being set. We should add this to the documentation to prevent future problems and as a heads up for people self-hosting scrumlr.