moved lastfm auth flow to server side, moved keys to an excluded file (invalidated old keys as well