fixes #16 by generating dynamic secret token (ignores .secret file in repo)