fix secret token for heroku