Bugfix: SECRETS.session_name and .session_secret have no effect

I was cleaning up `config/application.rb` today, and noticed that in the `before_initialize` block there is the following:

```ruby
config.session_store :cookie_store, :key => SECRETS.session_name || "calagator"
config.secret_token = SECRETS.session_secret
```

However, there are two initializers: `secret_token.rb` and `session_store.rb` that run immediately after and stomp on these values, effectively making the secret key public, since `secret_token.rb` is on Github. AFAICT this has been the case since the upgrade to Rails 3.0 in 2011. Of course, this isn't really a big deal for Calagator, since there's no authentication. :)

As far as what impact changing the secret key will have on running systems, I believe all existing sessions will just be invalidated, but I'm not 100% on that. I ran some tests, and wasn't actually able to detect any changes when I changed the secret key, but I'm not super familiar with how this system works, to be honest.