Encourage practice of storing secret_key_base in env variable for security

It's time to start encouraging people store the app secret in an environment variable. It's in the guide, and the guide app even had a hardcoded value. Let's fix that.