make secret_token load from environment variables to work with heroku