[SDK-1087] Fix case where APP_SESSION_SECRET is set and appSession is not

[adamjmcgrath]

Description

The simple case with env vars

# .env
ISSUER_BASE_URL=https://YOUR_DOMAIN
CLIENT_ID=YOUR_CLIENT_ID
BASE_URL=https://YOUR_APPLICATION_ROOT_URL
APP_SESSION_SECRET=LONG_RANDOM_VALUE

const { auth } = require("express-openid-connect");
app.use(auth());

Was throwing Error: "appSession" is required

Testing

Run the simple case with environmental variables https://github.com/auth0/express-openid-connect#getting-started

• This change adds test coverage for new/changed/fixed functionality

Checklist

• [ ] I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not master