Refactor secret protection for Heroku

- Secrets moved to local ENV variables