Fixed #9: Moved "cookie secret" into env.