Removed secrete keys from web.js

Per the recommendation on the twitter apps key interface: "Keep the "API secret" a secret. This key should never be human-readable in your application."

Maybe you already do something different, but its generally a bad idea to keep API keys in your source code.  Set those secret vars as ENV vars instead in your heroku or hosting environment. 

Also probably regenerate your keys, although I could be mistaken.