Use a static secret key for tokens, when none is given

When the user doesn't specify SECRET_KEY, `app.secret_key` is None, not
a per-session value as one might hope.  In this case, tokens are
generated using a non-secret secret.  This is good for development, but
not for production, so the code issues a warning, too.
Merge pull request #53 from djmitche/empty-secret-key

Use a static secret key for tokens, when none is given
Merge branch 'master' of https://github.com/mozilla/build-relengapi
Added link to travis CI from main README file