moving client secrets to a settings file
renamed settings.js to config_example.js and load it as the global variable CONFIG in app.js; there is no client_id nor client_secret in config_example.