prep for heroku deployment
Allow overriding the signing secret from environment variable