Switch usage of the master key to the REST api key instead

This has object level permissions, which is much more suitable.