Remove use of 'api_key'

The 'api_key' field is no longer used for identifing which encryption
key should be used, so it does not server any purpose in the token.
Minor code cleanup in the AuthHandler