code: def unserialize(cls, string, secret_key):
          
          if isinstance(string, text_type):
              string = string.encode('utf-8', 'replace')
          if isinstance(secret_key, text_type):
              secret_key = secret_key.encode('utf-8', 'replace')
          try:
              base64_hash, data = string.split(b'?', 1)
          except (ValueError, IndexError):
              items = ()
          else:
              items = {}
              mac = hmac(secret_key, None, cls.hash_method)
              for item in data.split(b'&'):
                  mac.update(b'|' + item)
                  if not b'=' in item:
                      items = None
                      break
                  key, value = item.split(b'=', 1)
                  # try to make the key a string
                  key = url_unquote_plus(key.decode('ascii'))
                  try:
                      key = to_native(key)
                  except UnicodeError:
                      pass
                  items[key] = value
  
              # no parsing error and the mac looks okay, we can now
              # sercurely unpickle our cookie.
              try:
                  client_hash = base64.b64decode(base64_hash)
              except TypeError:
                  items = client_hash = None
              if items is not None and safe_str_cmp(client_hash, mac.digest()):
                  try:
                      for key, value in iteritems(items):
                          items[key] = cls.unquote(value)
                  except UnquoteError:
                      items = ()
                  else:
                      if '_expires' in items:
                          if time() > items['_expires']:
                              items = ()
                          else:
                              del items['_expires']
              else:
                  items = ()
          return cls(items, secret_key, False)
docs: Load the secure cookie from a serialized string.
  
          :param string: the cookie value to unserialize.
          :param secret_key: the secret key used to serialize the cookie.
          :return: a new :class:`SecureCookie`.