heroku security test and notes in secret_token.rb