Add support for reading config from envvars

This enables reading the secret key from TOOL_SECRET_KEY and the OAuth
client from TOOL_OAUTHCONSUMER_KEY + TOOL_OAUTHCONSUMER_SECRET. (The
double underscore is how Flask encodes nested dicts in environment
variable names.)