remove API key from public files and move it to .env

Remove the public key from the records controller, and reference it from the .env file.