add cookie secret and enable cookie-based sessions