Prevent mongo url and password showing in heroku logs

We noticed our MongoHQ password was showing in the logs when meteor was starting up.  

I added a note to the readme about specifying MONGO_URL in the Heroku config.