use environment variable for SECRET_KEY since the repo is public