clarify how the SECRET_KEY is setup, we don't have a builtin (not secret) SECRET_KEY any more