moved secret key from settings to configuration