Add fail-fast specs to detect missing CMM_API_*

* New developers may overlook setting their CMM_API_* environment
  variables, and this will cause odd 401 forbidden/failed errors in
  their specs. Adding this fail-fast makes it instantly clear what's
  wrong and how to fix it

* Update README to reflect the fact that we don't really use
  config/secrets.yml except to interpolate these vars
Merge pull request #7 from cmm/fix_oob_specs

Add fail-fast specs to detect missing CMM_API_*