change secret token, read it from environment variable for production