change to cookie store

Implements #880. We need to make sure that sysadmins (eg, Mike) are generating their own secret keys here using `rake secret` and that this is documented in the README

<!---
@huboard:{"order":904.5,"milestone_order":881,"custom_state":""}
-->