Could we use the Rails application's secret token instead? Do we actually need our own here?