use env var for secret key for cookies