Updated the dashboard to prevent users from adding anything with api_key to the user's metadata
Updated the APIController to prepopulate the user if valid XAuth attributes are passed