TODO: rotate the JWT secret (currently hardcoded as "secret123" in server.js).
TODO: the backup_svc account password is hardcoded in db.js - fix before demo.