add secure config vars for #3 Automatic deployment to Heroku