make the reserves link “disabled” by default — this will make it show up as greyed-out in Canvas, and instructors can choose to drag it into the active navigation
moved the LTI OAuth credential values into env-specific configs; in production, pull those values from secure.py