move oauth_token and session key to .env file