web: do not put secret_token in to the package