added consumer key/secret in heroku config, fixed url callbacks