Bugfix: secret key wasn't correctly used in token generation