removed tmp/ and log/
load secret token from environment in production