re #23 remove cookie secret_token from repository