Cookie secret should not be committed to the repo

[ericelliott]

We should encourage users to load the cookie secret from an environment variable. See dotenv for an easy way to manage that.

[ericelliott]

Here's a sample of how to use .env files for configuration.

Here's the dotenv config for the start script.

[morenoh149]

echo https://github.com/keystonejs/generator-keystone/issues/39