#99 add test for user.getApiKey()
mark setApiKey() as deprecated to indicate that it should not be used by the client code.