make secret token non-public for potential future production use