move secret token to an env variable

just a little more secure for production since this repo is being
developed public
Merge pull request #1 from ddgriffin/remove-secret-token

move secret token to an env variable