Extract secrets to environment. Fixes #29

New secrets can be generated with `rake secret`. The secrets can be
placed in .env in development. On Heroku, run `config:set`:
heroku config:set RAILS_SECRET_KEY=[x] DEVISE_SECRET_KEY=[y]

Unfortunately, changing the secrets will break existing session and
login cookies, but there's no avoiding that, as having the secrets
shared publicly as they are currently is a security hole.