BigUps Security by Removing Public Secret_Token

Instead, pull secret_token from hidden file & use config vars in production on Heroku.

A new local secret_token can be created by running `rake secret` and copying the result into a /secret_token file in the root directory.

Fixes #6