more secure secret_token initializer: dont store in github repo
create config file if it doesnt exist