guard against too short application.secret