add heroku secrets, update doc setup