save secure token in .secret