move secret token to an env variable

just a little more secure for production since this repo is being
developed public