[turner] use android secure hls host and catch token extraction errors