api auth fix for basic and jwt

makes sure we encrypt the jwt token using the correct secret
(from apiKey.properties) and make sure to check the secret key
for basic auth as well.
The secret is not a queryable property.  Sending as a request parameter has no effect.

The secret must be compared locally after API Key retrieval (this is by design, specifically because specifying secrets or passwords as query parameters is a security risk).