add secrets, no cookies used in W-A-W
use compiled asset path for images
include 12factor gem
drop title from route, extract rating logic to controller