Get allowed access tokens from environment

The easiest safe place to store these tokens at the moment is in the
environment.