Shared secret from env + not per-app.

[UPDATED]   Read shared secret from env too, to facilitate Heroku deployment.