trying secret cookie in a different place, no idea why heroku is whingeing