get secret_token always from application.yml