changed secret key to use environment variable instead of config