hiding secret token in production