Don't version control config.py

We should only keep the config template in git. Keeping config.py (even as
a symlink) creates all kinds of problems:

1. modifying it for your deploy shows up as local changes
2. easy to accidentally `git commit -a` and push sensitive data
3. doesn't correspond to the instructions in HACKING.md
Add JOURNALIST_KEY instructions for developers

Some rearranging for a clearer set of instructions, minor style fixes.
Merge remote-tracking branch 'upstream/master'