Generate the Rails secret token on first run.

Security: keep the Rails secret token out of version control.

See

http://blog.phusion.nl/2013/01/04/securing-the-rails-session-secret/
AND
http://blog.codeclimate.com/blog/2013/03/27/rails-insecure-defaults/