Removing visible site cookie secret, now it pulls from local var
OK secret is still safe, but a dev secret is in place so machines run just fine