remove SECRET_KEY from settings and move them to settings.json because SECRET_KEY should never be shared or be made public on GitHub