We can add comments to the config file but it doesn't really matter for the test build. You have to set a `secret_key` to be able to use `flask.session`.

The key in production will be randomly generated. Also, this is only to let people find their tokens easily if they've already gone through OAuth (along the same lines as the top right token access in the [current docs](http://data.adicu.com/docs/Documentation)). The session won't have anything to do with rate-limiting.