Lock down values returned for api key json.
Generalize token flow away from being facebook-only. Cleaner code, simpler code/specs.