set the Rails secret token via ENV variable