adapt API key encoding for unhosted web apps

run the app key/secret through https://dl-web.dropbox.com/spa/pjlfdak1tmznswp/api_keys.js/public/index.html
 as per https://github.com/dropbox/dropbox-js/blob/master/doc/getting_started.md#browser-and-open-source-applications

you would have to adapt Nimbus.Auth() to deal with this different param of course, in this PR i just wanted to suggest how its interface could look for unhosted web apps where you have no way to keep the API key secret. see https://github.com/dropbox/dropbox-js/blob/master/doc/getting_started.md#browser-and-open-source-applications for more details.