secure secret token

this fixes #66 
Remember to clear browser cookies for local development urls (localhost:3000) and production too (www.compliancechimp.com