Reorder arguments to bash command

$0 is treated as the name of the command in the event of an error,
and it would be cool if our error logs don't include our secret key
Don't use the `timeout` command to enforce the timeout

Apparently it's not in Heroku's environment