Took out the trash.
Secret token is set to env var or generated randomly.
Added attr_accessible to models.
Updated CAS authentication.

* Removed tgt cookie check. Use stock rubycas-server.
* Updated specs.
Drop unused db table.