refs #2109 - restrict secret token to root:foreman, move before service start