security_key defaults to nil, not 'MY_SECURITY_KEY'

nil is a useful value, as it generates unsigned "unsafe" URLs suitable
for hitting thumbor running in unsafe mode - often the case in
development environments etc.

'MY_SECURITY_KEY' probably isn't a useful value for anybody.
Merge pull request #5 from pda/security-key-default-nil

security_key defaults to nil, not 'MY_SECURITY_KEY'