Move cookie secret to settings. #7