set secret token for real