note about secret_token.rb