Admin cookie guards fail closed when ADMIN_SECRET is unset.