api: prevent running with default SECRET_KEY