config secret_token to use ENV var