add secret to cookie_hash method for +security