Generate the Rails secret token on first run.

Store the secret token in a .gitignored file called ".secret", which is
created by the initializer if it doesn't exist.
Merge pull request #4040 from smashwilson/generate-secret

Security: keep the Rails secret token out of version control.