Add setup notes about secret_token.rb