use `req.signedCookie`