change cookie secret logic