It should be set so things like persistent settings and OAuth work correctly.

We could grep it from the generated LocalSettings and preserve it. This is good because it will be random for different installations.

Alternatively we can set it to a static non-secret value and allow users to overwrite at their discretion (as an environment variable). This has the advantage that if users bring down the wikibase container and start it up again then the configurations they have made in OAuth consumers and the cookies their browsers have will still be valid.

I think the latter is probably the way to go and is consistent with the current setup of static users and passwords.