moved secret key and iv to a separate file (not committed).
do not commit secret.js.