Removed secrete keys from your 

Per the recommendation on the twitter apps key interface: "Keep the "API secret" a secret. This key should never be human-readable in your application."

Maybe you already do something different, but its generally a bad idea to keep API keys in your source code.  Set those secret vars as ENV vars instead in your heroku or hosting environment. 

Also probably regenerate your keys.
Merge pull request #5 from bcomnes/master

Removed secret keys from web.js