permission, first version
move cookie_secret to conf.py