Add test to ensure token secret is being used properly when generating the signing key (hint, it isn't currently)