Quick deployment was missing a step.
Make it clearer that the packaged secret token file should *not* show up in production.