simplified cookie secret logic