Remove possibly confusing comment about secret token
Use server-side secret_token.rb in production