Added api and session keys.  Configured so they are secret.