moving auth keys and salts into environment variables