Use credentials for secrets

[benmelz]

In general this is something we should do, but slightly more pressingly, the secret_key_base is set via an environment variable (stored somewhere on the server in the passenger config) which makes booting a production console difficult (you really just have to set the SECRET_KEY_BASE="something" environment variable, but that's not so obvious).

Should be rather similar to jobapps#463.