allow envvars to handle secrets
battling bitrot
web security thingies