Use a new cookie secret, and keep it secret this time