:recycle: use env var for token create

backend/lib/services/user.js

      * @returns {Token}
      */
     createToken(data, expiration = 600) {
-        const key = this.server.registrations['main-app-plugin'].options.jwtKey
+        const key = process.env.APP_SECRET
         const obj = {}
         Object.assign(obj, { ...data })
         return JWT.sign(obj, key, { expiresIn: expiration })