Use AES to secure cookie, fix #28