make clear that config/secrets.yml passes through ERB and therefore supports ENV