Throw an error if a custom Auth Secret has not been set

[jasonbahl]

Leaving the default Auth Secret makes it easy for Auth Tokens to be forged and attackers to gain access to a site.

This plugin should throw an Exception if the Auth Secret has not been set via filter or the constant.

[duffn]

This looks to be closed in #88.