Clarify the role of the access code in the URLs

[NicMcPhee]

There was confusion about where the access code goes in the URL, and in particular what happens if we provide an access code in calls to the Morris web server. It (happily) turns out that our server ignores the access code and the tests work and pass, but that was confusing for some of the students.

We should also say something about reading access codes from etc/access_keys.properties in readAccessKeys(), as well as explaining the need to copy access_keys.properties.sample over to the "secret" version that is ignored by git.

[NicMcPhee]

I think this has changed beyond all recognition by now, especially with the switch to environment variables, so I'm going to close this and we can open a new one if there are issues down the road.