generate secret token in bootstrap script