move devise and app secret tokens into application.yml