env variables, simple shared secret, demo auth

This sets up two additional API endpoints explicitly used for testing.
Also, constrain all parsing of environment variables to a single
location.

This change also creates no API at all unless there is an API secret
defined.

Also the API_SECRET is really just a shared key private key, we
actually use the sha1 sum digest of the key.