Fill session cookie secret with random generated app_uuid.

By default this setup is much more secure since it uses
SignedCookies instead of plain ones

development.ini

@@ -293,9 +293,11 b' beaker.cache.sql_cache_long.key_length ='
 ## file based cookies (default) ##
 #beaker.session.type = file
 
+beaker.session.key = rhodecode
+beaker.session.secret = ${app_instance_uuid}
 
-beaker.session.key = rhodecode
-## secure cookie requires AES python libraries
+## Secure encrypted cookie. Requires AES and AES python libraries
+## you must disable beaker.session.secret to use this
 #beaker.session.encrypt_key = <key_for_encryption>
 #beaker.session.validate_key = <validation_key>
 

production.ini

@@ -293,9 +293,11 b' beaker.cache.sql_cache_long.key_length ='
 ## file based cookies (default) ##
 #beaker.session.type = file
 
+beaker.session.key = rhodecode
+beaker.session.secret = ${app_instance_uuid}
 
-beaker.session.key = rhodecode
-## secure cookie requires AES python libraries
+## Secure encrypted cookie. Requires AES and AES python libraries
+## you must disable beaker.session.secret to use this
 #beaker.session.encrypt_key = <key_for_encryption>
 #beaker.session.validate_key = <validation_key>
 

rhodecode/config/deployment.ini_tmpl

@@ -293,9 +293,11 b' beaker.cache.sql_cache_long.key_length ='
 ## file based cookies (default) ##
 #beaker.session.type = file
 
+beaker.session.key = rhodecode
+beaker.session.secret = ${app_instance_uuid}
 
-beaker.session.key = rhodecode
-## secure cookie requires AES python libraries
+## Secure encrypted cookie. Requires AES and AES python libraries
+## you must disable beaker.session.secret to use this
 #beaker.session.encrypt_key = <key_for_encryption>
 #beaker.session.validate_key = <validation_key>