make docs more clear about configuration (config file format / secure cookie)