Add COOKIE_SECRET to README and prevent new session secret from being generated on every request