Provide info in readme about 'secret' and use securecookie to generate the secret, instead of relying on /dev/urandom