set application secrets with env variables
add SESSION_SECRET and PEPPER env variables to app.json