Support API signing instead of passwords

Passwords can still be provided to provided if the request was signed
via a "user-less" key, otherwise the API requests are bound to the given user