move cookie secret to settings