Use the default secret token only on dev and test

This will also raise error on production if env SECRET_TOKEN is not set.
A new token can be generated using `rake secret` task.
see: http://daniel.fone.net.nz/blog/2013/05/20/a-better-way-to-manage-the-rails-secret-token/