clarify config-secret.php instructions
apikey authentication
fix uri_part() references from before the /api directory shuffle