Move token secret to Rails.config, add fixture for images