fixed leaky string copy; moved curl setup to constructor/destructor; removed API key and added config option for it