Replace cookieSecret with __COOKIE_SECRET__
Return a 404 rather than 500 for nonexistent block lists.