Move secret token out of repo; use dotenv for dev. variables

also, set I18n.enforce_available_locales to git rid of deprecation
message