It also seems weird to me to raise this exception when defining routes, rather than when asking for the secret key.  You want to raise this exception even if the app doesn't use refworks export at all, and will never run into the problem, on app startup? Route definition seems an odd place to raise to me, on this one. Your call though.