[#1422] More secure default for the repoze secret key

The who.ini file has a secret key used during authentication. To make sure
users don't forget to update it we can use the beaker session secret which
is generated randomly when creating the ckan ini file.

If users define a secret in the who.ini file, this one will be used.

To do this, we use a small custom plugin that checks the secret key and
calls the core repoze plugin afterwards.
[#1437] Instruction to restart apache and nginx
Add restart instructions in upgrade docs too