add secrets.yml

use environment variable for production
add warning message
fix flash messages
add access control for arguments
redirect to prosncons.io

for heroku only
add bin
also redirect root