added dotenv and hid the secret token in production in heroku