Should an error from generateSecret be checked here? What happens if the cookie generateSecret is looking for is not there?

Also, should this be a POST with CSRF protection?