Read secret token from environment in production.

When in production we would like to read the secret token from the environment
so we can keep reusing the values between deploys without having to commit it
to a public repository.
Explain how to set a secret token on Heroku.

Before deploying you need to set a secret once. This documents how to generate
a secret and configure it in Heroku.
Merge pull request #11 from Manfred/features/safe-secret-token

Using a safe secret token