don't crash without secret token

instead ensure we always give output, and return an invalid token. This does not allow us to start the server, but it does allow us to compile assets (needed for deploy to heroku from travis)