pulling SECRET_TOKEN from ENV.