moved secret token to ENV variable & updated README

I think it's a good practice to not expose secret tokens for open source apps.Modifying secret_token.rb to point to the SECRET_TOKEN environment variable requires setting the token on Heroku. I updated the README to include those instructions, in addition to other steps essential to a successful deployment.