Fix API auth bug, and show apiKey at /profile

This does two things:

- shows apiKey in web interface after connecting via oauth
- fixes an issue that was preventing the apiKey from actually being used (since for whatever reason it still bounces through oauth server each time anyway, I guess to make sure user account is still active or something…)