Move secret_token to heroku config