fetch secret token for signing cookies from config

We had the secret itself in the git repo. Not a good idea at all. It's still set to sth. known in development and test environments. But production deploy needs to set this up in the config.