Final refactor of private config data

Whoops :) Submitted my (now old) Google password to github. This is what
happens when one person does too many things too fast on Pulsar. Anyway,
config.local.js is now require()'ed into config.js. Don't ever add
config.local.js to a public git, keep the file under wraps.