Make 'session options' secret default to cookie secret