Secure secret token

Set ENV['SECRET_TOKEN'] in production mode, and use insecure token elsewhere. 

http://daniel.fone.net.nz/blog/2013/05/20/a-better-way-to-manage-the-rails-secret-token/