If you use the same secret for two different parts of your application to sign something (without the salt this would apply) it could allow an attacker to get his chosen plaintext signed, which would allow the attacker to control what the cookie variable contains. Since by default the PickleSerializer is used this would allow an attacker to potentially inject dangerous pickle content into the Python process.

Re-using the secret (the hmac key) in two different locations could drop the security of signing to 0.