Update SECRET_KEY setting's reference documentation

[Pi Delport]

Context: #17800 made the SECRET_KEY setting required.

The Django 1.4 release notes ​detail this change, but the reference documentation doesn't mention it.

[Pi Delport]

GitHub pull request: ​265

[Claude Paroz]

AFAICS, I don't see that anything changed in the default value of SECRET_KEY. The change is that Django will not start if it is empty.

[Pi Delport]

You're right; i had assumed that the deprecation would effectively remove the old default, but the actual default value still remains in 1.5's global_settings. Perhaps the default value should actually be removed entirely, as it's no longer usable, and serves no other purpose as far as i can tell?

In any case, here is an updated patch: ​#269. This keeps the documented default as it is, and also adds a more prominent warning about the security implications of running with an exposed SECRET_KEY, along the same lines as the 1.4 release notes (since this is what motivated the whole change in the first place).

[Simon Meers <simon@…>]

In [e38112d882a8aec0aaf6d52ab6d07fa1a408a3aa]:

Fixed #18759 -- updated SECRET_KEY documentation

Document SECRET_KEY becoming required in 1.5.

Also expand the description slightly, and add a more prominent warning
about the security implications of running with an exposed SECRET_KEY.