auth: simplify API key auth - move it out of _determine_auth_user This gives less of the special handling of API key auth in LoginRequired ... but we still need to disable the LoginRequired CSRF protection for API key auth.

pytest >= 3.3.0, < 3.8
pytest-runner < 4.3
pytest-sugar >= 0.7.0, < 0.10
pytest-benchmark < 3.2
pytest-localserver < 0.5
mock < 2.1
Sphinx < 1.8
WebTest < 2.1