add a soft puma dependency so people can run Discourse on puma
fix secret_token init to always allow an override even if its too short
mucking with my measure script