security: don't use hardcoded SECRET_KEY, use random one if unset. close #11