changed secret key to come from config