Replace secret token with ENV variable

See README