needed session secret in cookie parser