add note about sharing config files with cookie_secret