add SECRET_KEY for flash messages