title: Rails 3 additional session configuration options (key, expires_after, secure)
body: <p>Can someone point out what the new Rails 3.x session configuration options are?</p>
  
  <p>I'm trying to duplicate the same configuration that I have in my Rails 2.3.x application.</p>
  
  <p>This is the configuration that I used in the application:</p>
  
  <pre><code>#environment.rb
  config.action_controller.session_store = :active_record_store
  
  config.action_controller.session = {
      :key         =&gt; '_something', #non-secure for development
      :secret      =&gt; 'really long random string'
    }
  
  
  # production.rb - override environment.rb for production
  config.action_controller.session = {
    :key            =&gt; '_something_secure',
    :secret         =&gt; 'really long random string',
    :expire_after   =&gt; 60*60,#time in seconds
    :secure         =&gt; true #The session will now not be sent or received on HTTP requests.
  }
  </code></pre>
  
  <p>However, in Rails 3.x, I can only find mention of the following:</p>
  
  <pre><code>AppName::Application.config.session_store :active_record_store
  
  AppName::Application.config.secret_token = 'really long random string'
  
  AppName::Application.config.cookie_secret = 'another really long random string'
  </code></pre>
  
  <p>Are there other config settings to control the key, expire_after time, and secure option?</p>
  
  <p>Regarding the latter, if "config.force_ssl = true" is set in production.rb, I assume the secure option is no longer required?</p>
  
  <p>Thanks very much!</p>