NGX_OMNIAUTH_SESSION_SECRET can sets only gorilla/sessions hash key. To support payload encryption and key rotation, change NGX_OMNIAUTH_SESSION_SECRET to parse in a comma-delimited format.