new secret_token, and keep it out of repo