use APP_KEY from environment if available for the secret key

Once APP_KEY is available in the environment variables, go ahead and use it.