Make /api/0/settings/ refuse to list master_key without authentication
Make the key/passphrase backup page work