mozilla/build-relengapi — pull request #53 by djmitche (2014-05-12 17:17:04+00:00)
Title: Use a static secret key for tokens, when none is given

When the user doesn't specify SECRET_KEY, `app.secret_key` is None, not
a per-session value as one might hope. In this case, tokens are
generated using a non-secret secret. This is good for development, but
not for production, so the code issues a warning, too.

@petemoore, what do you think?