use environment variable to set secret key in production