Add secret_key to README and config sample

The secret_key setting needs to be set in config.yml for most production
environments. Document this in README.md and provide an example in
config_sample.yml.