ensure devise secret key comes from environment for production