remove hardcoded secret token