different secret tokens for prod and rest
should probably reset these for production...