remove cookie_secret from single-user servers

pass encrypted cookies to Hub for verification