Move secret key out of version control

* Use environment variables
* Set dummy value for development
* Automatically generate values for new Heroku apps

More information: 
http://blog.codeclimate.com/blog/2013/03/27/rails-insecure-defaults/