Get secret token from environment variable, instead of from `.secret'.

Previously, the application's secret token was taken from `.secret', if
that was available. If not, it was generated automatically inside the
initializer.

This would lead to the server re-generating a secret token every time
the application was deployed via Mina. That, in turn, would lead to all
user cookies being invalidated, and them being logged out. This is a
serious issue during ticket release, since people will likely be
refreshing the page (while logged in), waiting for tickets to become
available. So, once tickets were released, they'd need to log in again,
which puts extra strain on the server.

This commit fixes the issue by storing the token inside an environmental
variable, which stays constant on the machine, between deploys.