models/settings, create
config/initializers/secret_token, hide secret_token