automatically insert ip into asset/publish host when {{ip}} is seen

for/in iterates over every (iterable) object property, irrespective of whether it's yours, or simply there because the JavaScript spec says it has to be there. `Object.keys()` on the other hand will only return keys you added. Before `Object.keys()` you needed to do `for (x in y) { if(!y.hasOwnProperty(x)) continue; ... }` to ensure safe code. `Object.keys()` solves a verbosity problem (ish) there, too.