Move secret token

Take secret token for securing cookies from repository, and
put in app_config.yml