hardcode dev/test token, but expect a ENV token from heroku