ensuring creds are not public 2
well maybe I cant use config vars on a free heroku account