use user-provided secure-cookie-key if it exists