read JWT and CORS from os.env.

[uwwint]

Description

Allow JWT Secret and CORS_ALLOWED_ORIGINS to be passed via environment variables.

Checklist

• I have commented my code, particularly in hard-to-understand areas
• I have added unit / integration tests that prove my fix is effective or that my feature works
• I have run all tests locally and they pass
• I have updated the documentation (if applicable)

How to Test Manually (if necessary)

Already tested in deployment.

[marius-mather]

Good to merge