Disable #yaml_import action for now

This was dead code anyway

thanks @brynary
Use setting from stie.yml instead of hardcoded secret token

Fallback to randomly generated token, which is fine for development and test mode. (Sessions will be invalidated when the server reboots)

Thanks @brynary
 Do not symbolize arbitray locale params

* Validate locale is valid before assigning it
* Don't convert invalid locales to symbols (creates DoS risk)

thanks @brynary
Introduce #onsite_redirect_to helper for onsite redirects

Prefer #onsite_redirect_to to #redirect_to when using untrusted input (e.g. cookies) in the redirect destination

Thanks @brynary