set secret default to be an empty string

secret should have an default string value, because in `cookie-signature`:
```
exports.unsign = function(val, secret){
  if ('string' != typeof val) throw new TypeError('cookie required');
  if ('string' != typeof secret) throw new TypeError('secret required');
```
it will throw err when secret is not string

a real case:

domain.com have 2 website: A & B
when site A set an signed cookie `sid` ,  and user visited site B which didn't set secret (no login needed, but parse cookie),   it will throw exception;