secret_token moved to environment variable