MS_TOKEN_SECRET when set (recommended in production; generate with
openssl rand -hex 32), else a per-process random secret. Memoised.
MS_TOKEN_SECRET when set (recommended in production; generate with
openssl rand -hex 32), else a per-process random secret. Memoised.