Check for secret_token

Warn on `secret_token`s in initializers, as discussed in #200.

Will add documentation links later.