Removed api_user access from regular users. Updated API tests to authenticate without CAS.