make secret token work in dev