Clean up .env handling

* SESSION_SECRET is now a mandatory environment value.

* Use .env.keys for authorization keys (Blogger API)