add secret token to heroku through CLI, load in production through ENV