sinatra server to hide access token using env