handle secret in cookie for convience