Use hardcoded secret token in development, but require env var of key in production.