PLFM-2372 - More auth revisions

Auth filter should check ToU for API key calls too, now that the boolean can be in any of the 3 states (before, you could only possess an API key if the ToU was True).