only set secret token and secret key base from env if we're in production, otherwise just set them to a dummy value.