Tweak README; move secret token out of codebase

also start using dotenv to manage all environment config variables