set config.secret_key_base in app's config