Allow external API key specification

[melange396]

Allow an API key to be provided by external means, such as via a GET variable, in the base64-encoded JSON, and/or via HTTP auth headers (or perhaps a different method entirely).

Full requirements still TBD.