use SECRET_KEY_BASE instead of SECRET_TOKEN

Calling it secret_key_base makes better