update secret to match auth app so signed cookies can be read