add note about secret token

as long as this token is known, one can create cookies that might
authenticate as any user.
See http://phenoelit.org/blog/archives/2012/12/21/let_me_github_that_for_you/index.html