remove Rails session secret from repo; use ENV