Production server now takes secret token from ENV