move secret keys into ENV variables