Warn if using ephemeral cookie secrets

Fixes #34