API_KEY and API_SECRET are both global and thread-local

This should cater to both a scenario where one would want to run multiple apps and where one needs a global setting for testing in separate threads. 
Tests are included and should be self-explanatory. 
Please let me know if there's something missing, or if you need anything else.

Thank you.