refactor preferences reset for specs (reduced core test from 9 min to 5 min)
Stringify api_key

By default there is no api key generated. I just managed to break into api on test installation using `?token[]`, one of my favourite CVEs
@radar, please take a look at Mr. Outsider's PR

Fixes #2492
Show variant images in admin/images if that's all there is

Fixes #2228