allow to provide secret token via environment variable

fixes #1013
Merge pull request #1039 from simplysoft/secret-token

allow to provide secret token via environment variable