Move secret to env

Also done:

```
$ heroku config:set RAILS_SECRET_TOKEN=<escaped>

> Setting config vars and restarting envato-hilander... done, v17
> RAILS_SECRET_TOKEN: <escaped>
```