Use a static secret key for tokens, when none is given

When the user doesn't specify SECRET_KEY, `app.secret_key` is None, not
a per-session value as one might hope.  In this case, tokens are
generated using a non-secret secret.  This is good for development, but
not for production, so the code issues a warning, too.
load blueprints before registering

This avoids issues where the order in which blueprints are loaded is
important.  The case that triggered this commit involved an authz action
(base.tokens.revoke) defined in one blueprint and used in another.
Include more docs on celery config
add a method to test celery
bump to 0.1.7