SECRET_KEY should be user-override and definitely not hardcoded

[ghost]

perhaps autogenerate one with the same algo as django startproject on settings.json create time if one doesn't exist. It certainly shouldn't be globally shared across all djangopypi2 installs...

https://github.com/popen2/djangopypi2/blob/master/djangopypi2/website/settings.py#L77

https://docs.djangoproject.com/en/dev/ref/settings/#secret-key