Made devise's security tokens get set from env vars. Added a check to ensure they're actually set (devise will accept nil :/).