Use ENV var for secret_token
Add brakeman with rake task
Use strong_parameters to guard against mass assignment
Skip CSRF check

The app does not use sessions and is only an API. CSRF does not apply.
Merge pull request #82 from github/brakeman

Add Brakeman