update secret_token to use ENV var