I always set app.key in an environment-specific config, but that doesn't mean someone else might not try to use the default
List config options that need to be set before deploying the app