Place SECRET_KEY in dev.py and local.py only

While fiddling with settings files I noticed it might make sense to enforce setting `SECRET_KEY` and other confidential data in `dev.py` and `local.py` but not in `base.py`.

This will make sure: 

 - Developers share the default settings by using `dev.py`
 - Production server data will never be committed (neither in `base.py` nor in `production.py`) but instead set in its `local.py`

Does this make sense at all?