Don't generate the secret_key until after loading local settings

Currently the settings.py generates a secret_key, then loads user
ovverides.  The former step requires write access in a directory
that the webserver has no real business trying to write to, which
is a security risk, amongst other things.

As a simple mitigation step, defer loading the default until after
the local_settings.py has been loaded.  Then the admins can decide
if/how the secret_key is stored (or not stored, as the case may be)
and in absentia of that, it uses the current behaviour of scribbling
files in odd places.

Fixes Bug: 1220884

Change-Id: I158702f9500563a4d16f6aefc1a3afea766b1e92
Merge "Don't generate the secret_key until after loading local settings"