use dotenv to hide credentials

90% review

Use dotenv to hide email credentials
It might be a good idea to chuck all of these settings into the environment config, as ideally we'll need this to be merged upstream as part of the cleanup process, and upstream might want all the settings to be configurable so that you can forward the email to any SMTP server rather than just Gmail.