hid secrets in ENV, forcing ssl