Add (string) case in encodeSecureCookie call to hash_hmac

Per http://php.net/manual/en/function.hash-hmac.php, the second argument to hash_hmac is supposed to be a string. HHVM (http://www.hhvm.com) is more strict about checking the arguments.

(note: this functionality is no longer present on develop)