.flaskenv files aren't loaded by default, unless you're running a flask command. This code change loads these variables as standard.

There are a couple of things here. The first is that the test needed the client, as it calls current_app.config. However, rather than passing the client, I've just patched the current_app.config dictionary and passed in my own very secret secret.  Finally, I've added freezegun. This allows us to check that the expiry is as we expect

Fix env vars