fix, set default secret
fix, replace cookie with session