removing /accessToken endpoint and oauth credentials

As it stands now anyone can hit our showcase heroku domain with /accessToken and get a valid token back.  I'm removing this and pulling the set credentials.