add dotenv gem and move secret vars from secrets.yml