Cookie secret warning in app_server never used

[guynir42]

The block of code in app_server.py warns the user that "Your server is insecure" is never reached.
I'm not sure if we should be checking against app.secret_key or instead of looking for cookie_secret inside cfg we should be looking for it under baselayer_settings.
I'm not sure what the logic should be, so I will leave it to @stefanv

[guynir42]

This is not an urgent bug.

[stefanv]

Either should be fine. The cookie is copied into the app config, but probably more direct to check the config itself.