Make API secret authentication more secure.

The `api_key` parameter is now computed using a combination of the
user's `username`, `api_secret` and a current api session token.  This
means that the `api_key` sent by the client is different every time they
try and authenticate, and makes it that much harder to MITM.