api.server: only load config once, and keep basic flask config

app.config contains flask internals such as DEBUG, so we should avoid
stomping on it entirely.