filter secret token by default

* should ignore rack_env.action_dispatch.secret_token