JWT_SECRET not configured in .env