Boyscout: provide secret_key_base instead of secret_token