code: function getSecretBag (req, sessionKey, cookie) {
    if (cookie) {
      // get secret from cookie
      var cookieKey = cookie.signed
        ? 'signedCookies'
        : 'cookies'
  
      return req[cookieKey]
    } else {
      // get secret from session
      return req[sessionKey]
    }
  }
docs: Get the token secret bag from the request.
  
  @param {IncomingMessage} req
  @param {String} sessionKey
  @param {Object} [cookie]
  @api private