remove hardcoded cookie secret