authn: allow APIToken to be also specified as ApiKey like Tastypie does...