fix(config): set default cookie secret