Fix test failures from missing DEVISE_SECRET_KEY .

If not supplied, use an empty string for `DEVISE_SECRET_KEY`. This
should only be used for tests, however; non-test environments must set
this properly to something random.