Change secret token to an environment variable

This is always a best practice, I believe the only reason rails doesn't do this
by default is because it would be difficult to get the project up and running.

This can be set on heroku with the command

heroku config:set SECRET_TOKEN="some_128_character_hex_string"

Note: this value has changed, so anyone currently logged in will be logged out.
It has to be changed because anyone with the secret token can be used to decode
cookies and steal sessions.