set secret token in production