move cookie salt into config