don't expose the secret token to the world, generate the secret_token on demand

its a secret token, nobody should see it :)

this removes the secret token and adds a generator