Structure/stability updates

* isolate config into config.js and add to gitignore, this way we can workon botname.js without commenting out secure info
* fix up userList manipulation so we do not throw NPEs (hopefully)