improve session encryption security with a randomish cookie key instead
of the site key