make cookie_secret configurable

allows config to specify logins that survive across server instances (default behavior unchanged).

Depends on PR #3372
add note about sharing config files with cookie_secret
Merge pull request #3373 from minrk/cookiesecret

make cookie_secret configurable

Allows config to specify logins that survive across server instances (default behavior unchanged).

Add warning about not sharing config files with cookie secret.