set secret token from environment variable in production

The secret token is hard coded in the config, this will read it from an environment variable instead (used approach from [member-directory](https://github.com/theodi/member-directory/blob/master/config/initializers/secret_token.rb))

The `SESSION_SECRET_CERTIFICATE` env var will have to be set before this can be deployed.

`ruby -e "require 'securerandom'; puts SecureRandom.hex(32)"` gives the kind of value for it.

This will expire all current sessions on the site