moved secret keys into .env so I can include secrets.js