markevans/dragonfly — pull request #344 by semaperepelitsa (2014-05-20 12:03:11+00:00)
Title: Remove default secret phrase, it should never be used

I don't know why but Dragonfly has a default "secret". That means an app could be using this default secret to sign requests and its owner would be unaware that "sha" URL parameter does nothing. If an app does not need the protection (for whatever reason) it should disable it altogether.

I'm not sure I've added "raise" in the right place. Maybe it should go into "job.sha" or "job.validate_sha!".