dotenv: secret token as .env for development