Ignore secret token if in .gitignore, add support for Rails 4 secret token

Sorry for the combo pull request, probably should have done this in the opposite order.

This adds a Rails 4 app for testing (need to add more actual tests later), fixes the session token secret key check to work with Rails 4 (since they had to change the property name), and will ignore the secret token if the file is in `.gitignore`.

Also sometime in the future, settings such as `rails3` should probably be fixed up to be semantically correct now that there will be a `rails4` very shortly.