use APP_KEY from environment if available for the secret key