set secret_key_base in app config