add support for SECRET_KEY

This makes it simple to get anything which depends on `app.secret_key` working.