make secure configurable via heroku