Same as above, we want to keep ./config/initializers/secret_token.rb out of our repository for CSRF, i think.  pinging @ericcf