added comments for clarity of where the cookie secret must be set