Allow api key passing to backend to be configured.

We want to deprecate passing api keys to the backend altogether, but as
an intermediate step, this is now configurable on a per backend basis.

Also fix oversight that meant the api key was always being passed to
backends if it was passed as an http basic auth username.