Default APP_PURCHASE_SECRET to SECRET

Deployments are failing since we aren't copying this over from `SECRET`.