added the heroku subdomain to allowed host
accepts all heroku subdomains (should be changed by user) and secret key is now env var