token secrect generated on install
moved the secret to .env