moved secret_key_base to env var