secret_token.rb hack