Move credential token and secret into separate variables.

Allow 3rd party apps, like PhoneGap/Cordova, to execute inline script
and get the token and secret key easier.