Hide the secret token for production app


```bash
heroku config:set secret=`rake secret`
```

Let's not be SQL-injectable

http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts