HTTP 400 if OAI auth key not needed. refs #7469

Added logic to return HTTP 400 if an OAI API key has been provided
during an OAI API request, but authentication isn't required.