Simplify config and make the secret token secrets

includes commits from #25, #26