use secrets.py file for development

- instead of an 'api.key' file, just use a 'secrets.py' file that can be
  easily imported