[feature] - passport local strategy now invalidates old apiKey
[fix] - user.setKeyChain works for invalid keycahin object in database
[feature] - mwc.model.Users.findOneByKeychain invalidates apiKey