use secrets.yml (that's the Rails way)