Switch usage of the master key to the REST api key instead

I'm not sure whether this should be a complete change (as I have coded), but I thought I'd put it in a pull request to find out what the opinions are.

It is mentioned in issue #85, and I wanted it for my project so that the app respects the parse permissions.