Remove visibility of MCTS API keys

MCTS keys are now to be manually edited into `secrets.js`, which will remain untracked. Readme instructions updated accordingly. Fixes #9.