docs: function setSecret (req, res, sessionKey, val, cookie) {
    if (cookie) {
      // set secret on cookie
      var value = val
  
      if (cookie.signed) {
        value = 's:' + sign(val, req.secret)
      }
  
      setCookie(res, cookie.key, value, cookie)
    } else {
      // set secret on session
      req[sessionKey].csrfSecret = val
    }
  }