app.js - use config.cookie.secret