require a SECRET_TOKEN in production