Need to set `TOKEN_SECRET` if using built-in token endpoint (which is the default)

[paulrobertlloyd]

Indiekit now has its own token endpoint. This requires a TOKEN_SECRET environment variable to be set with a secret value, else tokens can’t be issued, and it is therefore not possible to sign in or authenticate requests. Pretty important!

Add to the installation instructions a note about needing to set this value (or consider making the default https://tokens.indieauth.com/token

Depends on #400.