replaced secret_key_base literal with ENV var