S-48823 WIP: created apikey.js middleware to encapsulate logic

app.use(apikey);

This makes each request go through this middleware. However, I don't use it
until after setting up the static routes, which means they are still
accessible without the API key. However, this makes /instances crippled
because it wants an API key to call upon /api/settings now! So, this needs
to be addressed or deferred cleanly.