Fixed issue where application path would not be called correctly and dangerous assumptions about file locations were made.

security fix: .inc.php file for API key no longer readable by client.