security hardening

 - removes console logging
 - kindly asks the hackers to go attack something else
 - gives each app an unique token that is updated on the fly
 - enable production settings for socket.io

*****new***
Now we ask for an API key every time you click something