Generate secret token as needed

Don't store the secret token in config/initializers/secret_token.rb, but
in config/secret_token.  config/secret_token is gitignored and generated
on-the-fly if it does not exist.