secure token according to M. Hartl's tutorial