changed secret token to environment variables on heroku