moved secret_key to .env file -- team members must do the same