Make secret token depend on env variable

Otherwise people can hack

(In production, we'll have to remember to set this to something)