I'm fine with enforcing `openssl` - I agree about keeping the secret between sessions and using the same method as Heroku, mainly for consistency.

Users are welcome to use `$RANDOM` if they'd like instead, but let's make the "official" advice to mirror Heroku config as much as possible. Since neither of us runs VPS (that I know of!) it will help us be better able to debug future issues.