adding cookie secret to readme
Merge from upstream