modified secret_token.rb & routes.rb