read token from config var

remove tokens from manifest files