auto generated dev secrets (so the app runs for everyone)