load api key from environment variables

Instead of from code where everyone can see it.
remove node_modules
remove local.js from git

meant to be ignored and overridden locally