Use a static secret key for tokens, when none is given

When the user doesn't specify SECRET_KEY, `app.secret_key` is None, not
a per-session value as one might hope.  In this case, tokens are
generated using a non-secret secret.  This is good for development, but
not for production, so the code issues a warning, too.