Use an ENV variable for the secret token

Ref issue #6