SessionID cookie is now signed with the app secret.