now using ENV variables for all secret keys in production