properly define `cookie_secret` property