move cookie secret to env.json config