fixed security issue and cookie secret bug