empty default SECRET_KEY to be filled out by end-user