store tests next to keys and use secure cookies to prevent tampering