silly question, how do you hide an app's secret API key from the outside world if you're coding in js (eg for building nice.social)?