update bootstrap
use env var for secret keys