add expired! method to api keys. clean up specs a little