Redirect unauthenticated users to the sign in page
instead. Rationale:

- The content on the welcome page is what often belongs
  to a separate "marketing site". The marketing content
  is of no use on self-hosted instances, which typically
  have new signups disabled and are for internal use only
- (the real reason, let's be honest) a number of
  self-hosted instances are accessible over the public
  internet. Search engines index the nearly identical
  landing pages and see them as duplicated content.

Previously, I had changed the default value to "", to force
users to set the SECRET_KEY value (the app refuses to start
if SECRET_KEY is empty).

The problem with that is, out of the box, with the default
configuration, the tests also don't run and complain about the
empty SECRET_KEY.

So, a compromise: revert back to the default value "---".
At runtime, if SECRET_KEY has the default value, show a  warning
at the top of every page.