'secure' config setting configurable on heroku