include SECRET_KEY in token creation