security: Avoid hard coding a secret_token in the app.

Set the SECRET_TOKEN environment variable to keep sessions valid between
server restarts.