Add a middleware that checks API user validity.

This fixes an issue where a user could bypass fingerprint checks
if they were to specify an invalid API key but a valid CSRF token.