support setting public/private environment variable (e.g. for parsing token for applications)

Private env field can be used for auth token that needs to be used by client side application as env var.