Make passing api keys to backends via headers or query configurable.

This is an intermediate step towards deprecating and removing this
functionality in favor of having backends rely on the user-id header.