Expose app_id and secret directly on req.facebook

This change changes FaceplateSession to take the config object from a Faceplate construtor and put the app_id and secret values directly on the FaceplateSession (which the Faceplate middleware exposes as req.facebook).

This fix alters the only case where one of these values was being used (app_id was read from the plate object for getting the info for `app()`: #19 goes further and removes the use of that value altogether.

Exposing the app_id is still useful for other situations where these values are needed, such as the broken parts of in heroku/facebook-template-nodejs#11. This can currently be fixed with a solution like heroku/facebook-template-nodejs#12, but reading these values from the `plates` object is... well, a bad dependence on internal behavior.