make the SECRET_KEY be generated and put into a separate file.  It shouldn't be a big deal since this will almost always be run in a private network, but it's bad form.