changed secret key to env var rather than redis