clarify secrets in base.conf, move one to application.conf.default

Update your application.conf based on application.conf.default if your
server fails to start with:

    Oops, cannot start the server.
    com.typesafe.config.ConfigException$Missing: merge of system properties,base.conf @ jar:file:/home/niklas/Projekte/lila/target/bg-jobs/sbt_4cb511b/job-1/target/a584586c/67d70042/lila_2.13-3.2.jar!/base.conf: 407: No configuration setting found for key 'password'

conf/application.conf.default

@@ -1,4 +1,7 @@
 include "base"
 include "version"
 
+# change for additional encryption of password hashes
+user.password.bpass.secret = "9qEYN0ThHer1KWLNekA76Q=="
+
 # override values from base.conf here

conf/base.conf

@@ -30,7 +30,7 @@ play {
       cookieName = "lila2"
       maxAge = 3650 days
     }
-    secret.key = "CiebwjgIM9cHQ;I?Xk:sfqDJ;BhIe:jsL?r=?IPF[saf>s^r0]?0grUq4>q?5mP^"
+    secret.key = "CiebwjgIM9cHQ;I?Xk:sfqDJ;BhIe:jsL?r=?IPF[saf>s^r0]?0grUq4>q?5mP^" # public (lila does not rely on cookie signing)
   }
   ws {
     useragent = "lichess.org"
@@ -413,9 +413,6 @@ user {
     trophyKind = trophyKind
     ranking = ranking
   }
-  password.bpass {
-    secret = "9qEYN0ThHer1KWLNekA76Q=="
-  }
 }
 fishnet {
   redis = ${redis}