Add default secret token
Don't allow present key in production