generate new secret_token for cookies, store in external config