Remove setting SECRET_KEY from the environment

It should be in the config file, this was a hack from early development.
Let the app look in an instance folder for config.py
Add the instance folder to the search path for modules
Allow OAuthMethods to supplement how site admins are flagged

Added an implementation to TestOAuth as well.
Bugfix: Ignore duplicate characters from Test's OAuth API
Use the primary character name as the user's name for TestOAuth
Bugfix: Initialize Core API like it used to

I didn't specify the URL or skip the first API endpoint when I rewrote it in dc186047c6d7abdb0c46a5cf2f2a62bb5c48b380
BraveCore can now take hex strings for keys
Releasing 0.9.8: Death To All Bugs

Not a lot, mainly bug fixes introduced from 0.9.7.

* Fix multiple issues in BraveCore
* Update misc. documentation
* Have TestOAuth use the primary character as the user name
Start 0.9.9 development