move Devise secret_key and pepper to secrets.yml