Using a safe secret token

When people know this token they can use it to hijack sessions for signed-in users. It's usually a good idea to only keep the secret on your production servers.