added options for cookie secret and session secret