the secret key for signing JWT tokens is now read from server.secret.
if that does not exist, then a random UUID v4 is generated and used
instead. a log warning is also shown.
allows for config settings to be easily set through ENV variables,
config files, or CLI flags
adds flag to run migration on web server start (fixes#29)
