Remove secret_token initializer and set up linking on deploy

(Also, generated a new token that will not be checked in to git)
Don't run openid-selector images through asset pipeline

We need to be able to reference them without a hashed fingerprint