added cookie signing (key will be generated at first start of container)