Implement API Key Create/Update Endpoints

This probably doesn't represent 100% of the feature set we want (e.g. administrators cannot deactivate other users' keys), but I think it's enough to begin working on other areas.
The benefit is that each test can point exactly to a line or bullet point in the spec.  I feel like the way to address the copy/paste problem is to refactor into a reusable function.