Make it clear what secret is used by other middleware when multiple secrets are provided

[SantaClaas]

I was looking into how this middleware works together with cookie signing and from reading the README I couldn't figure out what secret will be used for signing the cookies by other middleware. That's why I added the additional sentence for future readers.