configuring secret token to use env variable in production