extra layer of security - bottle's cookie secret, refs #4