Remove .env from version control

- Will contain private api keys
Add artsy-xapp-middleware

- Gets XAPP token for Artsy API access