cookie parser secret and some refactoring