refs #2109 - restrict secret token to root:foreman