Switch to Heroku config rather than secret token