moving secret key to .env and documenting system variables