Use a .env file instead for privacy and encouraging open source!

At Artsy we've accidentally used `require 'config'` on the client, exposing hard-coded sensitive keys. We also ended up writing a .env file for our [desktop app](https://github.com/artsy/force-public) so it could go open source. Using this .env file by default will simplify things for everyone and make it harder to accidentally expose config on the client.