move cookie salt into config file instead of private variable