express-session - should the cookie signing secret be user-specific or site-wide? (also applies to fastify-session and fastify-cookie)