Extract all API keys to config files outside of the repo

[mattkatz]

Ideally, we shouldn't have these committed. That way people can't wantonly use our api key to run up our bill etc.