Adapt get_key() and send_key() to the spec.

* Use session_id instead of token for now.
* Receive info needed to interact with webapp API as params and
  setters/getters.
* Use the webapp API for sending the key to server.
* Prevent from refreshing own key.