Expand explanation of how to set secrets.yml.

The guide for upgrading to Rails 4.1.0 suggests copying the existing secret_key_base from the secret_token.rb initializer to secrets.yml under the production section. This is considered insecure by default in Rails 4.1.0, which generates a secrets.yml containing <%= ENV["SECRET_KEY_BASE"] %> for production mode:

    production:
      secret_key_base: <%= ENV["SECRET_KEY_BASE"] %>

So this expanded explanation offers users both methods.