fix 'secret' argument to cookieParser