make secret key come from env if not provided
Getting specs to pass. I hate myself.