Move build token into app configuration

Currently, controllers.php uses getenv() directly to get the build token.  This makes it hard to override, and awkward to test.  Why not put specify the token in app.php?  This pull request continues to use getenv(), but moves the definition to app.php.