make secret token an optional env variable for heroku deployment