generate new app secret & put it in an env var