secrets should not be in public version control

Instead of having the secrets put in a settings.py file, they should be in some other file that settings.py references. This other file should not be under version control in our public repository.