Handle missing auth/enc keys properly

I was very confused because if you miss out `make keys`, you get a
running app that sends you into an infinite oauth redirect loop :/