added required COOKIE_SECRET to readme and app.json