change to cookie store

Implements #880. We need to make sure that sysadmins (eg, Mike) are generating their own secret keys here using `rake secret` and that this is documented in the README