make API work with regeneratable api keys

people don't like to give their admin password to just anyone, so we are
generating api keys so they don't have to. API keys only have access to
what's inside this plugin.