remove secret key from config.py, moved to gitignored secret.py

this means that you need the secret key from the master dev machine,
which is me, and that the secret key needs to be updated from there
MANUALLY every time a deploy occurs