secret token and rspec