switched to enviroment variable for secret, so nobody deployes from the (not so) secret_token in the repo.