Use a file-based secret_token, not the one that github knows