add SECRET_KEY_BASE to app config