with client-sessions 0.3.0, we can use the same secret for all cookies. Is it easier for ops to only have to worry about 1 secret?