backwards compatibility -- devise secret_key vs. secret_token y4y