Hide the secret token for production app

A `heroku config:set secret=`rake secret` ` is needed too.

Let's not be SQL-injectable

http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts