Different secret token for production

Fixes #43.
Allow position_applications#show for student users
Merge remote-tracking branch 'satu/authorize-students-for-position-application-show'