add a new endpoint for secret key creation that only accepts connections from localhost, change the login page logic to check for secret key presence in query string if the connection is not from localhost, disconnect all of the oauth stuff and add a new logout handler
write a script that takes one command line argument and hits the secret key creation endpoint from localhost
generate a new secret key every time the windows script launches an instance