Don't hardcode SECRET
update omniauth