Use dotenv in webpack build

Replace instances of process.env in the webpack bundle using
build-time environment variables. Environment variables can be
specified in a .env file.

The text replacement is performed by the `dotenv-webpack` package, a
wrapper for `dotenv` and `Webpack.DefinePlugin`.

SECURITY IMPLICATIONS

Do not reference any environment variables that contain sensitive
information. `dotenv-webpack` will expose all environment variables
that are explicitly referenced in client code.

We currently reference API_USER and API_PASSWORD in client code. When
login is implemented these environment variables should be removed,
and the password should be reset.

webpack.config.babel.js

@@ -1,5 +1,6 @@
 // @flow
 import path from 'path';
+import Dotenv from 'dotenv-webpack';
 
 import {
   PRODUCTION,
@@ -27,6 +28,9 @@ export default {
       },
     ],
   },
+  plugins: [
+    new Dotenv(),
+  ],
   devtool: PRODUCTION ? 'source-map' : 'eval',
   resolve: {
     extensions: ['.js'],