don't intentionally use a bad secret key

use the generated one as a default, and override from environment