added security for Heroku, secret token