Better configuration

* SECRET_TOKEN is loaded from config/secret_token.txt file in production
* database password is hidden in production