allow to provide secret token via environment variable

fixes #1013