create tmp security key when running locally

You might like it failing for security's sake...  but this ensures it works when someone first pulls.