Expand README.md, with some extra attention for the (Tornado) cookie secret

[Bison24]

Hi, I'm reading your documentation and was wondering if you can elaborate on the cookie stuff. I tried reading the tornado docs and it didn't help.

Do I need to create a cookie?

[bartbroere]

Sorry, I completely missed this issue when it was originally created. Creating cookies is not necessary. Setting a cookie secret is recommended. The cookie secret is any secret string you choose to encrypt (and later validate) the cookies you store on your bokeh clients. Security-wise it's recommended to not set it to something too obvious, like the string bokeh or tornado or something like that, but otherwise feel free to choose anything.

It's not even that important to remember the secret. If you forget it all users need to re-authenticate, but that's the only consequence.

[bartbroere]

I'll leave this ticket open since the documentation could indeed use some work.