encourage practice of storing secret_key_base in env variable for security