Allow authenticated users to access api without key

I ran into an issue where one of the backend views was trying to access the API's states_controller in json request. It was getting rejected with a invalid_api_key error. 

Looking at the base_controller, it seems the spec was not properly configured since it was setting `Spree::Api::Config[:requires_authentication] = false`. Unless I'm missing something, shouldn't that spec be verifying the user when authentication is in fact required (as opposed to when it is not)?

In any case, it probably doesn't make sense to authenticated logged in users twice, i.e. in two different before_filters. It was happening in both `check_for_user_or_api_key` and `authenticate_user`.

Please let me know if I'm missing something, but this fixed my use case and (I believe) a spec that was previously passing for the wrong reason.