Move Flask secret into .env
Use single quotes