secure ruby APIs with spooky tokens