allow cookie secret to be loaded from environment