Fixes ``ApiKeyAuthentication`` security issue (#795).

``ApiKeyAuthentication`` assigns user to request object basing only on
username checks what will change current user to any provided through
username value. This caused an security vulnerability when used in conjuction
with other auth backends using ``MultiAuthentication``.

Added tests for security issue described in #795