Cleanup the .env / default setup

[cycomachead]

• we should not require messing with so many variables to boot the app
• SECRET_KEY_BASE should be defined in dev
• it should be easy to define various CANVAS_URLs
• We should warn on missing but expected data
• the same sample env files should be tweaked for development