adding configurable secret key option, readme, and test

This should resolve https://github.com/krakenjs/lusca/issues/29
It was global, but not mutable until this change.

Solving could be as easy as something like:
```javascript
var validator = token(req, secretKey);
validator.validate(req, token);
```
```javascript
function create(req, secretKey) {
  // do interesting things
  return {
    validate: function validate(req, token) {
      if (typeof token !== 'string') {
        return false;
      }
      return token === tokenize(token.slice(0, LENGTH), req.session[secretKey]);
    }
  };
}

Unfortunately, this change would require a major version rev due to the fact that it changes the interface of a configurable token implementation.