Looking more closely you basically have to have at least one set - if `secret_key_base` is not set then it warns, and if `secret_token` is also not set then it just throws an exception whenever `env_config` is called on the application object.