strip out authentication state manager and put into AuthController
cleanup
get secret token from environment and restore secret_token.rb to files being tracked