got secret tokens out of VC, Devise now uses app wide secret instead of it's own