Read secret token from an environment variable, since we definitely don't want it in version control. That's wicked insecure. This vulnerabilty was caught by brakeman. Thanks, brakeman!
Merge branch 'keep_a_secret'