use env vars for secret_token and secret_key_base in production