Require api key confirm for redistributing final gift

Redistributed gift based on support email, and then realized that I hadn't gotten the API key to do the actual account deactivation. Probably a good idea to enforce this, so that we don't somehow redistribute gifts without being sure of the identity of the person who contacted us :)