security fix: check ENV for rails secret token

As per: http://biggestfool.tumblr.com/post/24049554541/reminder-secret-token-rb-is-named-so-for-a-reason

Having this secret token in github can make it possible for people to steal our session cookies.  This makes it look for an environment variable instead (but falls back to a fake secret token if you don't have one, as in most dev environments.)

I have set the environment variables on the staging and production heroku apps.