fixes #10 by pulling the SECRET_TOKEN for cookies from environment variable (set in /etc/environment)