secret token comes from env if available otherwise defaults to
development token