21f3560e08
A hardcoded fallback 'acapisecret' was silently used when SECRET was not set, allowing JWT tokens to be forged by anyone knowing the default. The app now throws at module load time if SECRET is absent.